HIPAA Assessment

Assess Health Insurance Portability and Accountability Act (HIPAA) compliance for "$ARGUMENTS". Evaluate Privacy Rule, Security Rule, Breach Notification Rule, and Business Associate Agreement coverage.

Prerequisites

Read .metapowers/compliance/$ARGUMENTS/00-scope.md. If this file does not exist, tell the user:

Phase 0 (Scope) has not been completed for "$ARGUMENTS". Run /compliance:regulatory-landscape $ARGUMENTS first, or use --skip-checks to bypass.

If --skip-checks is present in $ARGUMENTS, skip this check.

Process

1. Read context files:

   • Read plugins/compliance/shared/grc-lifecycle-guide.md for GRC methodology reference
   • Read plugins/compliance/shared/assessment-template.md for output structure
   • Read .metapowers/compliance/$ARGUMENTS/00-scope.md for scope and control framework context

2. Entity classification:

   • Determine if covered entity (health plan, healthcare clearinghouse, healthcare provider with electronic transactions)
   • Determine if business associate (handles PHI on behalf of covered entity)
   • Assess hybrid entity considerations
   • Document entity classification with rationale

3. Privacy Rule assessment:

   • Assess permitted uses and disclosures of Protected Health Information (PHI)
   • Evaluate minimum necessary standard implementation
   • Review individual rights: access, amendment, accounting of disclosures, restriction requests, confidential communications, right to receive notice of privacy practices
   • Assess Notice of Privacy Practices (NPP) content and distribution
   • Evaluate authorizations for uses/disclosures not otherwise permitted
   • Review de-identification methods (safe harbor vs expert determination)
   • Assess marketing and fundraising communication compliance

4. Security Rule assessment:

   • Administrative safeguards: security management process (risk analysis, risk management, sanction policy, information system activity review), assigned security responsibility, workforce security, information access management, security awareness training, security incident procedures, contingency plan, evaluation
   • Physical safeguards: facility access controls, workstation use, workstation security, device and media controls
   • Technical safeguards: access control (unique user ID, emergency access, automatic logoff, encryption), audit controls, integrity controls (mechanism to authenticate ePHI), person/entity authentication, transmission security (integrity controls, encryption)
   • Classify each safeguard as required vs addressable
   • Score each safeguard: implemented / partially implemented / not implemented

5. Breach Notification Rule assessment:

   • Assess breach risk assessment methodology (four-factor test)
   • Evaluate individual notification procedures (within 60 days of discovery)
   • Assess HHS/OCR notification procedures (within 60 days for breaches affecting 500+ individuals, annual log for smaller breaches)
   • Review media notification requirements (500+ in a state/jurisdiction)
   • Evaluate breach documentation and investigation processes

6. Business Associate Agreements (BAAs):

   • Inventory all business associates handling PHI
   • Assess BAA coverage (all BAs have current, compliant agreements)
   • Review BAA terms for required provisions
   • Evaluate BA monitoring and compliance verification procedures
   • Assess subcontractor BAA flow-down requirements

7. Write the artifact to .metapowers/compliance/$ARGUMENTS/01-assess/hipaa.md following the assessment template structure with:

   • Entity Classification — covered entity, business associate, or hybrid determination
   • Privacy Rule Assessment — use/disclosure controls, individual rights, NPP status
   • Security Rule Assessment — administrative, physical, technical safeguard scoring
   • Breach Notification Readiness — risk assessment methodology, notification procedures
   • BAA Inventory — coverage assessment and agreement adequacy
   • Risk Analysis — overall risk posture and highest-risk areas
   • Evidence Inventory — existing evidence and evidence gaps
   • Remediation Priorities — ranked list of gaps to address

Output

The HIPAA assessment written to .metapowers/compliance/$ARGUMENTS/01-assess/hipaa.md. Present a summary to the user highlighting:

• Entity classification determination
• Privacy Rule, Security Rule, and Breach Notification readiness scores
• BAA coverage percentage
• Top 3 gaps requiring remediation